[jayminwest]

Stacked on #1356 (warren-4780). Article IX: needs a human merge.
This PR changes .github/workflows/auto-merge.yml, so the Article IX gate refuses auto-merge, and it carries no-automerge as well. It targets ui-visual/golden-approval-4780 so the diff stays reviewable. Retarget it to main after #1356 merges.
The branch also merges current main (it needs #1359's design-review workflow). Until #1356's branch picks up main, "Files changed" includes #1359's files. The commit feat(auto-merge): ... holds this change alone.

What

Seed warren-dbef (plan pl-10db step 16). A PR whose diff touches src/ui/** or scripts/ui-visual/** now arms auto-merge only after the ui-visual and design-review check runs both report success on its exact head sha. Every other PR behaves as before.

• scripts/ui-visual/required-checks.ts: new self-contained gate in the style of baseline-approval.ts. The workflow runs it from the base branch tip with the same fail-closed wrapper: only hit=false from a gate that exited 0 permits arming.
  • Only check runs count. Commit statuses are ignored. A check run must come from the GitHub Actions app (app.slug == github-actions).
  • A ui-visual run counts only when its check suite belongs to a pull_request run of .github/workflows/ui-visual.yml on the same head. That excludes a second workflow with a job of the same name, and the update_goldens dispatch, which reports success without comparing.
  • Among the runs that count, the newest one decides.
  • The refusal names each check and its state, for example ui-visual concluded failure; design-review is queued on <sha>. It goes to the log, a notice annotation, and the job summary.
• Timing (auto-merge.yml): the workflow now also runs on workflow_run of UI design review (completed). One completes after every ui-visual run, success or failure.
  • A new targets job holds the existing admission if:. On pull_request it emits this PR. On workflow_run it runs the sweep (required-checks.ts targets): open, non-draft, unarmed PRs by the owner or an AUTO_MERGE_BOT_LOGIN login, without no-automerge, whose head has both checks green. All of it is read from the API, never from the payload.
  • enable-auto-merge is now a matrix over that list and judges every PR with all three gates (Article IX, baseline approval, UI checks) from scratch.
  • The first run after a push refuses while the checks are pending, and disarms any earlier arm. The disarm step now covers both UI gates. --match-head-commit and the head-moved guard from feat(ui-visual): human-only approval for golden baseline changes; auto-merge refuses without it (warren-4780) #1356 are kept.
  • Rejected alternatives: a check_run trigger (a GITHUB_TOKEN-written check does not start workflows), polling (holds a runner for the length of a review), and re-running the first run (it replays stale labels).
• baseline-approval.ts adds required-checks.ts to GATE_PATHS, so a change to the new gate always needs a human merge.
• Docs: docs/design/ui-visual-gate.md gets a new "The merge gate" section, the dbef scope row moves to shipped, and the names and limits are updated. AGENTS.md "Protected paths" gains one sentence pointing there. The scripts/ui-visual/README.md is updated too.

Validation

• bun test on the new required-checks.test.ts (pure logic plus a fake API), the new required-checks.workflow.test.ts (runs the step's shell against a scratch repo with stub gates, and pins the triggers, sweep, matrix, mint/arm/disarm conditions), plus the updated baseline-approval*.test.ts and article-ix-gate.test.ts: 106 pass.
• actionlint .github/workflows/auto-merge.yml: clean.
• The pre-commit check:all gate is green.
• Live read-only run against GitHub:
  • gate on feat(ui-visual): human-only approval for golden baseline changes; auto-merge refuses without it (warren-4780) #1356's head allowed it (its ui-visual check was traced through its suite to a pull_request run of ui-visual.yml).
  • gate on feat(ui-visual): design-review workflow and status check for UI PRs (warren-a694) #1359's head refused with design-review has not reported.
  • targets listed only feat(ui-visual): human-only approval for golden baseline changes; auto-merge refuses without it (warren-4780) #1356.

Limits (documented in the design record)

• A workflow on a same-repo branch with checks: write can create a design-review check as GitHub Actions. That check is written through the Checks API, so its check suite cannot prove its origin. Follow-up suggested: protect .github/workflows/ with a human-merge rule.
• UI PRs into a base other than main never get both checks, so they never auto-merge.
• Sweep runs report on main's Actions page, not on the PR.